---
title: "PATCH /templates/{TemplateArn}/accessControlEntries/{GroupSecurityIdentifier}"
method: PATCH
path: "/templates/{TemplateArn}/accessControlEntries/{GroupSecurityIdentifier}"
---

# PATCH /templates/{TemplateArn}/accessControlEntries/{GroupSecurityIdentifier}

`PATCH /templates/{TemplateArn}/accessControlEntries/{GroupSecurityIdentifier}`

Update a group access control entry you created using <a href="https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_CreateTemplateGroupAccessControlEntry.html">CreateTemplateGroupAccessControlEntry</a>.

## Path parameters

- `GroupSecurityIdentifier` string, required
- `TemplateArn` string, required

## Request body

- object
  - `AccessRights` object — Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.
    - `AutoEnroll` 'ALLOW' | 'DENY' — Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment
    - `Enroll` 'ALLOW' | 'DENY' — Allow or deny an Active Directory group from enrolling certificates issued against a template.
  - `GroupDisplayName` string — Name of the Active Directory group. This name does not need to match the group name in Active Directory.

## Response `200`

Success

## Other responses

- `480` — AccessDeniedException
- `481` — ValidationException
- `482` — ResourceNotFoundException
- `483` — ThrottlingException
- `484` — InternalServerException
- `485` — ConflictException

---

[API](https://skmtc.net/aws/apis/pca-connector-ad.md) · [All operations](https://skmtc.net/aws/apis/pca-connector-ad/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/pca-connector-ad/revisions/ab51ba01ae5f/schema)